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DETAILED ACTION 



Response to Amendment 

1 . The amendment filed on 08/27/2007 is insufficient to overcome the rejection of 
claims 1-16 based upon Veres et al. as set forth in the last office action of 05/24/2007. 
However a new ground(s) of rejection has been made in this office action in view of 
Veres et al. and a newly found reference Kloth. Rejection follows. 

2. Claims 1-16 are pending in the application. Claim 16 canceled. 



Claim Rejections - 35 USC § 103 



3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious at the 
time the invention was made to a person having ordinary skill in the art to which said subject matter 
pertains. Patentability shall not be negatived by the manner in which the invention was made. 



4. Claims 1-15 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Veres et al. [US Pat: 6,807,156] in view of Kloth [US Pat: 6,598,034]. 

Regarding claim 1, Veres et al in the invention of "Scalable Real-Time Quality of 
Service Monitoring and Analysis of Service Dependent Subscriber Satisfaction in IP 
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Networks" disclosed a traffic measurement system (Figs 3-4) comprising: a plurality of 
measurement devices (probes or processes monitoring traffic at points A & B of 
Fig 3) that collect packets flowing through Internet links between routers (monitors A & 
B monitoring links between routers, Fig 3, col 8, lines 51-65), extract (capture) 
traffic data required to analyze traffic from the collected packets (item 120 of Fig 4), 
and process the extracted data into predetermined flow types (microflows, col 8,lines 
66-67,col 9, lines 1-5); and an analysis server that identifies applications (subscriber 
identification and applications) of traffic by analyzing the traffic data transferred from 
the plurality of measurement devices as a whole (col 9, lines 6-10), classifies the 
identified applications into predetermined traffic types, and outputs the classification 
result (col 9, lines 10-12), but fails to disclose analyzing the traffic data includes 
analyzing payload data included in the traffic data. However, Kloth in the invention of 
"Rule Based IP Data Processing" disclosed a method for analyzing the payload data of 
an IP traffic flow coming into the routing engine for classifying the packet (col 10, lines 
17-19, col 2, lines 15-20, col 2, lines 43-45). Therefore it would have been obvious for 
one of ordinary skill in the art at the time the invention was made to include the method 
of analyzing the payload data of the traffic data as taught by Kloth in the system of 
Veres et al to analyze every part of the traffic data packet to accurately classify the 
packets in to predetermined application type. One is motivated as such in order to 
accurately classify the packets by analyzing the payload data included in the traffic data 
to minimize the drop rate of the packets to enhance the quality of service. 
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Regarding claim 2, Veres et al disclosed that a plurality of time receiving devices 
that extract time signals from a GPS satellite or a CDMA base station to synchronize the 
times of the plurality of measurement devices (col 2, lines 50-53). 

Regarding claim 3, Veres et al disclosed each of the plurality of measurement 
devices comprises: a packet collection unit that collects the packets flowing through the 
Internet lines from router connection lines and records the collection times of the 
packets (packet filtering process, item 120 of Fig 4, col 8, lines 66-67, col 9, lines 
1-5); a flow generation unit (item 140 of Fig 4) that generates flows using the packets 
having the same data (microflow processor, item 130 of Fig 4), including a target 
address, a protocol, and a port number (col 6, lines 21-26), from the packets collected 
by the packet collection unit (captured packets stored in shared memory for flow 
identification, col 9, lines 6-13), extracts data required for detailed analysis of the 
applications after analyzing the contents of the packets (col 6, lines 20), and stores the 
extracted data according to the flow (database of monitored microflows); and a 
transfer unit that transfers the data stored in the flow generation unit to the analysis 
server according to a predetermined time interval (col 9, lines 14-45). 

Regarding claims 4-5, Veres et al disclosed that the packet collection unit 
collects the packets by using one of tapping (probing or sniffing), port mirroring 
(application dependent port, FTP, HTTP, TCP, col 3, lines 18-33) and signal 
distribution and the data required for detailed analysis of the applications are application 
signatures (service dependent applications, RTP, FTP, WWW etc.,) for identifying 
the applications in payload of the packets (col 4, lines 44-61). 
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Regarding claim 6, Veres et al disclosed wherein the analysis server (microflow 
processor, item 130 of Fig 4) comprises: a data receiving unit (network interface and 
shared memory, item 110 of Fig 4, col 9, lines 14-29) that receives the packet data 
from the plurality of measurement devices (probes or processes monitoring traffic at 
points A & B of Fig 3); a traffic analysis unit (prefiltering processor, item 120 of Fig 
4) that analyzes the data provided from the plurality of measurement devices via the 
data receiving unit as a whole (col 9, lines 30-45), and classifies the applications into 
the traffic types (WWW, FTP, Streaming Media, VoIP application dependent 
module, item 140 of Fig 4, col 9, lines 5-13) according to the analysis result; a data 
storing unit (database of monitored subscribers/microflows, Fig 4) that stores the 
traffic analysis result (delay, throughput, efficiency, packet loss etc.,) of the traffic 
analysis unit; and a user interface that displays the traffic analysis result stored in the 
data storing unit to a user after processing the traffic analysis result into various types 
desired by the user (user reports, col 4, lines 44-67). 

Regarding claim 7, Veres et al disclosed that the analysis server further 
comprises a report output unit (report, item 140 of Fig 4) that processes the traffic 
analysis result from the traffic analysis unit into a predetermined report type (col 5, 
lines 31-67) and stores the processed data in the data storing unit (database of 
monitored subscribers/microflows, Fig 4), and the report is displayed (microflow 
record) to the user through the user interface (col 11, lines 23-29). 

Regarding claim 8, Veres et al disclosed that the traffic types comprise: a first 
traffic type (TCP) whose applications are identified using only TCP/UDP port numbers 
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{col 9, lines 30-37); a second traffic type (IP) whose applications are identified by 
collecting application headers and application signatures (service dependent 
applications, RTP, FTP, WWW etc.,) that are included in payloads of the packets (col 
9, lines 31-33); a third traffic (UDP) type whose applications are identified by extracting 
application data from the second traffic type (prefilteration), since application data is 
not included in reverse traffic of the second traffic type (col 9, lines 46-54); a fourth 
traffic type (RTP) whose applications are assigned predetermined port numbers are 
identified based on application signature of other flows since the port numbers are 
exchanged through an other control flows; and a fifth traffic type (VoIP, item 140 of Fig 
4) whose applications are not classified into the first through the fourth traffic types (col 
9, lines 60-67). 

Regarding claim 9, Veres et al disclosed a traffic analysis method performed in a 
traffic measurement system (probes or processes monitoring traffic at points A & B 
of Fig 3) that collects packets flowing through Internet links between routers (monitors 
A & B monitoring links between routers, Fig 3, col 8, lines 51-67), analyzes traffic, 
and identifies the applications of the packets (col 9, lines 1-29), the method comprising: 
classifying a first traffic type (TCP) whose applications are identified using only port 
numbers included in flow data that is processed into a predetermined type (col 6, lines 
21-26); classifying a second traffic type (IP) whose applications are identified by 
collecting application headers and application identifiers in the packets, from the flow 
data remaining after the first traffic type is classified (col 9, lines 30-41); classifying a 
third traffic type (UDP) whose applications are identified by analyzing the flow data 
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remaining after the second traffic type is classified (col 9, lines 1-4) and reverse- 
direction flow data (both directions of traffic stream) of the flow that are measured at 
different points as a whole (col 10, lines 50-57); classifying a fourth traffic type (RTP) 
whose applications are identified by analyzing the flow data remaining after the third 
traffic type is classified and flow data measured at different points, since port numbers 
for the applications are not predetermined (col 10, lines 62-67, col 11, lines 1-2); and 
classifying a fifth traffic type (VoIP, item 140 of Fig 4) whose applications cannot be 
identified using the flow data remaining after the fourth traffic type is classified (col 9, 
lines 60-67), but fails to disclose that applications are identified by collecting application 
headers and application signature that are included in payload of the packets. However, 
Kloth disclosed a method for analyzing the payload data and classifying an IP traffic 
flow coming into the routing engine by collecting application headers and application 
signature (packet header and data pattern, col 4, lines 38-56) that are included in 
payload of the packets (col 10, lines 17-19, col 2, lines 15-20, col 2, lines 43-45). 
Therefore it would have been obvious for one of ordinary skill in the art at the time the 
invention was made to include the method of analyzing the payload data and classifying 
an IP traffic flow coming into the routing engine by collecting application headers and 
data pattern as taught by Kloth in the system of Veres et al to analyze the payload data 
by collecting application headers and application signature that are included in payload 
of the packets. One is motivated as such in order to analyzing the payload data and 
classifying an IP traffic flow by collecting application headers and application signature 
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that are included in payload to efficiently identify the predetermined application of the 
data traffic to improve the throughput of the system. 

Regarding claim 10, Veres et al disclosed the flow data is packets having the 
same target address (destination port), the same protocol (FTP), and the same port 
number among the packets flowing through the Internet lines (col 11, lines 34-45). 

Regarding claim 1 1 , Veres et al disclosed determining whether identification data 
of the fourth traffic type (RTP) is present in traffic included classified into the first traffic 
type (TCP) and extracting and storing the application signature of the fourth traffic type, 
after classifying the first traffic type (col 9, lines 30-37, Fig 4). 

Regarding claims 12-13, Veres et al disclosed extracting and storing the 
application signature of traffic classified into the third traffic type (UDP) when traffic 
classified into the second traffic type (IP) is backward traffic of traffic classified into the 
third traffic type, after classifying the second traffic type (col 10, lines 50-67) and 
determining whether identification data of the fourth traffic type (RTP) is present in traffic 
classified into the second traffic type and extracting and storing the application signature 
(service dependent applications, RTP, FTP, WWW etc.,) of the fourth traffic type, 
after classifying the second traffic type (col 11, lines 1-12, Fig 4). 

Regarding claims 14-15, Veres et al disclosed taking statistics on traffic classified 
into the fifth traffic type (VolP/RTP for voice) in order to monitor the applications and 
storing the statistics result, after classifying the fifth traffic type (col 15, lines 49-55) and 
processing the classified traffic types into predetermined report types desired by a user 
and storing or providing the processed report through a user interface, after classifying 
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the fifth traffic type (col 15, lines 57-63, Fig 8c). 

Response to Arguments 

5. Applicant's arguments filed on 08/27/2007 with respect to rejection of claims 1-16 
have been considered but are moot in view of the new ground(s) of rejection. 

Conclusion 

6. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 



Application/Control Number: 10/693,416 Page 10 

Art Unit: 2619 

7. Any inquiry concerning this communication or earlier communications should be 
directed to the attention to Venkatesh Haliyur whose phone number is 571-272-8616. 
The examiner can normally be reached on Monday-Friday from 9:00AM to 5:00 PM. If 
attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Edan Orgad can be reached @ (571)-272-7884. Any inquiry of a general 
nature or relating to the status of this application or proceeding should be directed to the 
group receptionist whose telephone number is (571)-272-2600 or fax to 571-273-8300. 

8. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov . Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-9 197 (toll-free). 



Venkatesh Haliyur 



Patent Examiner 

, , EDAN .ORGAD 
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